To: 


Of: 


1CO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Solar Style Solutions Limited 


15a Yarm Street, Stockton on Tees, TS18 3DS 


The Information Commissioner (“Commissioner”) has decided to issue 
Solar Style Solutions Limited (“SSSL”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is 
being issued because of a serious contravention of regulation 21 of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003. 


This notice explains the Commissioner’s decision. 


Legal framework 


SSSL, whose registered office is given above (Companies House 
Registration Number: 07674048) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 

his to be listed in the register kept under regulation 26 has notified 

a caller that he does not, for the time being, object to such calls 

being made on that line by that caller, such calls may be made by 

that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at any 
time, and 
(b) where such notification is withdrawn, the caller shall not make such 


calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 

that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The TPS is a limited company 
set up by the Commissioner to carry out this role. Businesses who wish 
to carry out direct marketing by telephone can subscribe to the TPS for 


a fee and receive from them monthly a list of numbers on that register. 


Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of any advertising material which 
is directed to particular individuals”. This definition also applies for the 
purposes of PECR (see regulation 2(2) PECR and Schedule 19 para 430 
& 432(6) DPA18). 


Under section 55A (1) of the DPA (as amended by PECR 2011 and the 


Privacy and Electronic Communications (Amendment) Regulations 
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2015) the Commissioner may serve a person with a monetary penalty 


notice if the Commissioner is satisfied that - 


“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 


2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


10. The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the |CO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


11. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
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strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to th 


SSSL is an organisation specialising in the installation of renewable 


energy technology, with an emphasis on solar panels. 


SSSL first came to the attention of the Commissioner in October 2018, 
when a particular Caller Line Identity (“CLI”) was identified in the ICO’s 
‘Monthly Threat Assessment’ (“MTA”) as being a CLI used by one of the 
organisations responsible for generating the most complaints for that 

month via the TPS. The same CLI appeared in the MTA for March 2019. 


The Commissioner served a Third Party Information Notice (“3PIN”) on 
the Communications Service Provider (“CSP”) on 7 May 2019 for that 
CLI in order to establish the identity of its subscriber. The 
Commissioner also sought details as to any other CLIs being used by 


that subscriber over a prescribed period. 


The CSP responded to confirm that the CLI quoted belonged to SSSL 
and identified a full range of CLIs allocated to the company. The CSP 
provided call volumes and call detail records (“CDRs”) for the period 28 
February 2019 to 6 May 2019. 


The Commissioner carried out a thorough search of the complaints 


logged against those CLIs between 13 February 2018 and 29 April 
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2019 to both the TPS and the Commissioner’s Online Reporting Tool 
(“ORT”). A total of 123 complaints were logged. 


Some of the complaints contained comments such as the following: 


“It is primarily a disruption rushing to the phone only to discover it is 
an unsolicited call, and then annoying to discover that no matter how 
many times you ask to be removed from a list (and promises made to 
do so) that the calls keep coming. It annoys me that they have our 


” 


number. Where did they get it, who sold it to them? .... 


| told them - immediately | wasn't interested. This was the second or 


third call I've received from the same number this week.” 


“I'm fed up of the interruptions as I'm in the middle of writing a thesis 
on an advanced energy saving measures! This salesperson was trying 
to convince me they could save me money by installing PV Solar Cells. 
They obviously hadn't checked the TPS register as she stated they 
could remove me from their database after | told her this number was 
on the TPS!” 


“Solar paneling (sic). The company uses multiple numbers to try and 
contact and despite numerous requests to remove my number from 
database and explain TPS registration the calls do not stop. This has 
been going on for over one year. They 'claim' to be ringing for 
someone of a different name [.......]' but this is just a ploy to try and 


engage the homeowner in a conversation about solar panels.” 


The Commissioner sent an initial investigation letter to SSSL on 22 May 
2019 setting out her concerns regarding their compliance with PECR, 


and asking a number of questions in respect of their practices and 
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policies. The letter contained an appendix of complaints, and requested 


details of consent to call the complainants. 


SSSL responded to the Commissioner’s initial enquiries on 18 J une 
2019. In brief, SSSL explained that it uses 11 CLIs (later confirming 
that only one was used for the purpose of making outbound calls); that 
it used the trading name “The Energy Efficiency Team at Solar Style 
UK” during calls”; that the data it used for the purposes of its direct 
marketing came through a variety of sources including door to door 
marketing, existing customers and data purchased from a third party 
provider; that where data was acquired directly from customers a 
contact permission form was signed; that data from its provider was 
purchased in “good faith” and on the basis of the provider’s terms and 
conditions contained in a footer to email exchange regarding purchase 
of a marketing list which stated: “....consists of information sourced 
from consented online and offline lead generation and surveys. The 
data collected is compliant with all current applicable laws and 


regulations surrounding the use of third party data”. 


The correspondence did concede a level of naivety on the part of SSSL, 
saying: “..in the past purchased what we (sic) believed naively to be 
TPS screened data and we haven't followed our own process in making 
sure this was done”. It referred to the fact that the call monitoring 
system had suffered neglect by previous owners. The correspondence 
also referenced a new process actioned by SSSL following the 
Commissioner's investigation letter, including purchase of a TPS licence 


and screening call lists against the TPS register. 


The Commissioner issued a further letter to SSSL on 26 J une 2019 
requesting details of the contract held with its third party data 


provider, how consent is obtained via canvassing, any due diligence 
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performed on third party data, further details of the new process 


implanted by SSSL and an explanation of how SSSL considered the call 


monitoring system to have previously been neglected. 


The subsequent response from SSSL dated 3 July 2019 revealed that 
there was in fact no existing contract, instead stating that “all data was 
purchased in good faith”. Consent was collected from the door at point 
of first contact. The responding director indicated that the majority of 
data purchased preceded his appointment as director, and that SSSL 
no longer used their previous provider, swapping to a different provider 
in relation to which terms and conditions and a GDPR compliance pack 


were supplied. 


SSSL further confirmed that it had purchased a TPS licence on 5 June 
2019 and that it had begun to screen data from 17 June 2019. 
Evidence of subscription was provided. It explained that as the 
previous owners of the company were in arrears with the CSP, the 
phone system was not updated and therefore not working to its full 
potential. It was anticipated that the new system, which enabled TPS 
checks, would be implemented within 4 weeks (subsequently the 
commissioning date was confirmed as week commencing 26 August 
2019) and copies of communications with the CSP were provided in 
support. SSSL advised that its website was also being updated with a 


new privacy policy. 


The Commissioner proceeded to serve a further 3PIN on the CSP on 5 
July 2019 to obtain call records for SSSL in relation to the CLI used to 
make outbound calls. The CSP advised that despite calls having been 
made since 13 February 2018, owing to their retention policy the only 
dates for which CDRs could be provided were between 1 J anuary 2019 
and 29 April 2019 (“the relevant period”). 
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The CDRs provided to the Commissioner were then relayed to the TPS 
to establish how many of the numbers dialled belonged to subscribers 


who had been registered with the TPS, and the dates of their 


registration. 


In its response, the TPS confirmed that during the relevant period 
there had been 188,665 outbound calls made to subscribers, of which 
126,019 were made to subscribers who had been registered with the 
TPS for not less than 28 days at the time they received a call. This 


translates to 66.8% of all calls made. 


The Commissioner is satisfied that these calls were made for the 


purposes of direct marketing as defined by section 122(5) DPA18. 


During the relevant period a total of 29 complaints were received by 
the TPS and ORT, some of these alluding to multiple calls having been 


made to the same subscriber. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by SSSL and, if so, whether the 


conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that SSSL contravened regulation 21 of PECR. 


The Commissioner finds that the contravention was as follows: 


34. 


39; 


36. 


37. 


38. 


& 
ICO. 
Information Commissioner’s Office 
Between 1 January 2019 and 29 April 2019, SSSL used a public 
telecommunications service for the purposes of making 126,019 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in 29 complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 126,019 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to SSSL 


to receive calls. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by SSSL arising from the organisation’s activities over 
a 4 month period, and this led to a substantial number of unsolicited 
direct marketing calls being made to subscribers who were registered 
with the TPS, and a significant number of complaints being made as a 
result. Calls to TPS registered numbers comprised 66.8% of the total 


call volume over the relevant period. 


SSSL provided evidence (supported by their CSP) that the organisation 
had made 758,138 calls between 13 February 2018 and 29 April 2019, 
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although the CSP was unable to provide CDRs for the entire period. It 

is entirely reasonable to suppose, given that 66.8% of calls were made 

to TPS registered numbers during the relevant period, and SSSL 

operated under the same business model, that a similarly significant 

proportion of those calls over a broader period of time were to TPS 

registered numbers. Indeed, the Commissioner received a significant 


amount of complaints about unsolicited marketing calls from SSSL in 


that period. 


The 126,019 unsolicited direct marketing calls made between 1 
January 2019 and 29 April 2019 were made from CLIs which were 
being used by SSSL. This information has been obtained from SSSL’s 
CSP and is reasonably relied upon by the Commissioner. These calls 
were not screened against the TPS register, nor is there any evidence 
of consent being provided to SSSL from the individual subscribers. 
There is no evidence of any contractual terms between SSSL and their 
data providers, or of any due diligence checks being carried out to 
ensure the veracity of the data being obtained. In short, SSSL have 
failed to provide the Commissioner with any evidence to demonstrate 


an intention to comply with PECR. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner does not consider that SSSL deliberately set out to 


contravene PECR in this instance. 
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The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether SSSL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 
She is satisfied that this condition is met, given that SSSL relied 
apparently entirely on direct marketing due to the nature of its 
business, and the fact that the issue of unsolicited calls has been 
widely publicised by the media as being a problem. Given that it set 
out to embark on a direct marketing campaign, SSSL should 
reasonably have sought to familiarise itself with the relevant 


legislation. 


The Commissioner has also published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 
receive calls; or to any number registered with the TPS, unless the 


subscriber has specifically consented to receive calls. 


The Commissioner’s direct marketing guidance also makes clear that 
organisations acquiring marketing lists from a third party must 
undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. The 


Commissioner has been provided with no evidence that any such 
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checks were undertaken, rather SSSL claim to have been assured of 
the data’s veracity at the point of purchase but have failed to carry out 


any of their own checks. This would fail to satisfy the Commissioner’s 


requirement for due diligence. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that SSSL would have received a notification from the TPS 
for each of the complaints being made in this case. That there were 14 
complaints made to the TPS alone over the period of the contravention 
should have made SSSL aware of the risk that such contraventions 


may occur, and were indeed occurring. 


It is therefore reasonable to suppose that SSSL should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether SSSL 
failed to take reasonable steps to prevent the contravention. Again, she 
is satisfied that this condition is met. Reasonable steps in these 
circumstances may have included asking its third party data providers 
for evidence that the subscribers had consented to receiving calls from 
SSSL, screening the data against the TPS register itself regardless of 
any assurances that might have been given by the providers of the 
data, and ensuring that it had in place an effective and robust 
suppression list. Given the volume of calls to TPS registered numbers, 
and the nature of complaints, it is clear that SSSL failed to take those 


steps. 


There is also no evidence that, prior to the Commissioner’s 
intervention, SSSL sought to consult the Commissioner’s guidance, or 


to familiarise itself with the relevant legislation. By its own admission 
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SSSL did not seek to undertake any steps to ensure the integrity of the 

data it was purchasing, and has provided no evidence that the 

protection and privacy of subscribers was factored into the purchase of 

data with its providers. Additionally, it does not appear that there were 

any discernible policies or procedures in place for staff, nor was there 

any contractual arrangement in place between SSSL and its data 

provider. SSSL have explained these omissions away as ‘naivety’ on 

its part, however the Commissioner takes the view that such a reckless 

approach towards compliance with the law falls far short of the 

expected standard, and cannot be said to be anything other than 

negligent. Any internal suppression list operated by SSSL was 

ineffective given that complaints referred to multiple calls despite 

requests by subscribers for their details to be removed from the 


database. 


The Commissioner takes the view that SSSL failed to take reasonable 


steps to prevent the contravention. 


Whilst the Commissioner notes that SSSL has taken remedial measures 
to prevent future contraventions, including purchase of a TPS licence, 
screening calls against the TPS register, implementation of a new 
telephony service, inclusion of a privacy policy on its website and data 
protection training for its staff, these are a reactive approach to the 
Commissioner's investigation, in the absence of which contraventions 


would likely have continued. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to impose a monetary penalty 
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The Commissioner considers there are no aggravating features to be 


taken into account in this case. 


The Commissioner also considers there are no mitigating features of this 
case which would serve to reduce the amount of the penalty. Whilst 
significant remedial measures have been undertaken by SSSL these 
were reactive to the Commissioner’s investigation. The current directors 
state they only became aware of the contraventions following purchase 
of the company, however this is indicative that no due diligence was 
conducted, either in relation to the DPA or more generally upon 


purchase of the entire business practice. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


This has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking, and invited SSSL to 
make representations in response. In view of the current pandemic, 
SSSL had previously agreed to accept service of any Notices, and the 
Commissioner has a delivery receipt confirming service of the Notice of 
Intent on 15 December 2020. 


SSSL has not provided the Commissioner with any Representations in 


response to the Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary penalty in 


this case. 
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The Commissioner has considered whether, in the circumstances, she 
should exercise her discretion so as to issue a monetary penalty. She 
has decided that a monetary penalty is an appropriate and proportionate 


response to the finding of a serious contravention of regulation 21 of 
PECR by SSSL. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


The Commissioner has considered the likely impact of a monetary 
penalty on SSSL. The Commissioner notes that SSSL is currently 
subject to a CVA which is demonstrative that the company has 
encountered financial difficulties. The Commissioner was initially 
minded to propose a penalty of £100,000, however reduced the 
proposed amount by £10,000 taking into account the financial 
information available to her as at the date of the Notice of Intent. SSSL 
was invited to provide further financial representations and any 
evidence of financial hardship, in response to the Notice of Intent, 


however it has not availed itself of the opportunity to do so. 
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The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that the amount of the penalty is £90,000 (Ninety thousand 


pounds). 


Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 25 February 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 24 
February 2021 the Commissioner will reduce the monetary penalty by 
20% to £72,000 (Seventy two thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


a) the imposition of the monetary penalty 


and/or; 


b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
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Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


the period specified within the notice within which a monetary penalty 
must be paid has expired and all or any of the monetary penalty has 


not been paid; 


all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


period for appealing against the monetary penalty and any variation of 


it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner 
as an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 25th day of January 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 
against the notice. 


2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in accordance 
with the law; or 


b) to the extent that the notice involved an exercise of discretion by the 
Commissioner, that she ought to have exercised her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 


GRC & GRP Tribunals 
PO Box 9300 
Arnhem House 

31 Waterloo Way 
Leicester 

LE1 8D} 


a) The notice of appeal should be sent so it is received by the Tribunal 
within 28 days of the date of the notice. 


b) If your notice of appeal is late the Tribunal will not admit it unless the 
Tribunal has extended the time for complying with this rule. 
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The notice of appeal should state: - 


a) your name and address/name and address of your representative 
(if any); 


b) an address where documents may be sent or delivered to you; 
C) the name and address of the Information Commissioner; 

d) details of the decision to which the proceedings relate; 

e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 
monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the notice 
of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 


solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 


6. 


The statutory provisions concerning appeals to the First-tier Tribunal 


(Information Rights) are contained in sections 48 and 49 of, and Schedule 6 
to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 
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